Move ceil call back into the geometric sampler.

Test exactly what the geometric sampler returns, because that's what
the downstream callers of it are going to use.

While here, also assert that the geometric sampler returns a positive
integer.  (Our geometric distribution is the one suported on {1, 2,
3, ...} that returns the number of trials before the first success,
not the one supported on {0, 1, 2, ...} that returns the number of
failures before the first success.)

2 files changed, 12 insertions, 2 deletions

diff --git a/src/lib/math/prob_distr.c b/src/lib/math/prob_distr.c
index f5e5218aa7..e170d000fe 100644
--- a/src/lib/math/prob_distr.c
+++ b/src/lib/math/prob_distr.c
@@ -1308,7 +1308,7 @@ sample_geometric(uint32_t s, double p0, double p)
   if (p >= 1)
     return 1;
 
-  return (-x/log1p(-p));
+  return ceil(-x/log1p(-p));
 }
 
 /*******************************************************************/
diff --git a/src/test/test_prob_distr.c b/src/test/test_prob_distr.c
index 75e7e360a6..ec4e943e9a 100644
--- a/src/test/test_prob_distr.c
+++ b/src/test/test_prob_distr.c
@@ -958,7 +958,17 @@ test_stochastic_geometric_impl(double p)
     size_t C[PSI_DF] = {0};
 
     for (j = 0; j < NSAMPLES; j++) {
-      double n_tmp = ceil(geometric_sample(p));
+      double n_tmp = geometric_sample(p);
+
+      /* Must be an integer.  (XXX -Wfloat-equal)  */
+      tor_assert(ceil(n_tmp) <= n_tmp && ceil(n_tmp) >= n_tmp);
+
+      /* Must be a positive integer.  */
+      tor_assert(n_tmp >= 1);
+
+      /* Probability of getting a value in the billions is negligible.  */
+      tor_assert(n_tmp <= (double)UINT_MAX);
+
       unsigned n = (unsigned) n_tmp;
 
       if (n > PSI_DF)